Security audit
Security checks for vulnerabilities and agentic risk
The skill is local and purpose-aligned, but its examples encourage automatically turning untrusted errors and user corrections into persistent agent rules without enough review or privacy controls.
Review this skill before installing in agents that persist memory or configuration automatically. Use it only where generated rules are shown to a trusted operator first, sensitive details are redacted before submission, and any stored learnings have clear scope, retention, audit, and rollback controls.
handler.ts:101Untrusted Event Content Can Poison Persistent Agent Rules
This workflow captures full previous_attempt and corrected_output values and then feeds the resulting rule into agent memory, creating a straightforward path for sensitive user-provided content to be retained and influence future behavior. Because the skill is designed for self-improvement, integrators may normalize storing raw conversational data without considering privacy boundaries or prompt-contamination risks.
The examples explicitly encourage logging user corrections, previous outputs, and derived rules into memory or storage without any guidance on minimization, redaction, or retention. In practice, corrected outputs and error details often contain sensitive user data, so this workflow can cause unintended persistence and later reuse of private content in prompts, logs, or databases.
The user-correction example directs integrators to submit full prior and corrected outputs and then add the resulting rule to agent memory. That creates a natural-language retention channel where private user content may be embedded into long-lived memory or downstream prompts, increasing the chance of data leakage, over-collection, and unintended model conditioning.
The batch-processing example accumulates a day's worth of raw errors and corrections, including corrected outputs, for later analysis. Aggregating this data broadens exposure and increases the blast radius if logs, memory, or storage are accessed improperly, especially because operational errors and user corrections frequently include credentials, file contents, or personal data.
The skill accepts arbitrary context, detail, previous_attempt, and corrected_output values and returns them verbatim in entries, derived insights, and suggested rules, creating a local retention and re-exposure path for potentially sensitive user content. Because this skill is explicitly designed to capture learnings and corrections for future improvement, it increases the chance that secrets, personal data, or confidential prompts/errors are persistently recorded without redaction, consent, or minimization.